@wbce-d9/api 10.4.0 → 11.0.0

package/dist/controllers/utils.js

@@ -13,11 +13,15 @@ import asyncHandler from '../utils/async-handler.js';
 import { generateHash } from '../utils/generate-hash.js';
 import { sanitizeQuery } from '../utils/sanitize-query.js';
 const router = Router();
+const randomStringSchemaDesc = Joi.object({
+    length: Joi.number().integer().min(1).max(500).default(32),
+});
 router.get('/random/string', asyncHandler(async (req, res) => {
     const { nanoid } = await import('nanoid');
-    if (req.query && req.query['length'] && Number(req.query['length']) > 500)
-        throw new InvalidQueryException(`"length" can't be more than 500 characters`);
-    const string = nanoid(req.query?.['length'] ? Number(req.query['length']) : 32);
+    const { error, value } = randomStringSchemaDesc.validate(req.query, { allowUnknown: true });
+    if (error)
+        throw new InvalidQueryException(error.message);
+    const string = nanoid(value.length);
     return res.json({ data: string });
 }));
 router.post('/hash/generate', asyncHandler(async (req, res) => {

package/dist/database/system-data/app-access-permissions/app-access-permissions.yaml

@@ -41,6 +41,9 @@
   permissions:
     user:
       _eq: $CURRENT_USER
+  validation:
+    user:
+      _eq: $CURRENT_USER
 
 - collection: directus_presets
   action: delete

package/dist/env.js

@@ -191,8 +191,9 @@ const allowedEnvironmentVars = [
     'RELATIONAL_BATCH_SIZE',
     'EXPORT_BATCH_SIZE',
     // flows
-    'FLOWS_EXEC_ALLOWED_MODULES',
     'FLOWS_ENV_ALLOW_LIST',
+    'FLOWS_SCRIPT_MAX_MEMORY',
+    'FLOWS_SCRIPT_EXEC_TIMEOUT',
 ].map((name) => new RegExp(`^${name}$`));
 const acceptedEnvTypes = ['string', 'number', 'regex', 'array', 'json'];
 const defaults = {
@@ -270,8 +271,9 @@ const defaults = {
     EXPORT_BATCH_SIZE: 5000,
     FILE_METADATA_ALLOW_LIST: 'ifd0.Make,ifd0.Model,exif.FNumber,exif.ExposureTime,exif.FocalLength,exif.ISO',
     GRAPHQL_INTROSPECTION: true,
-    FLOWS_EXEC_ALLOWED_MODULES: false,
     FLOWS_ENV_ALLOW_LIST: false,
+    FLOWS_SCRIPT_MAX_MEMORY: 32,
+    FLOWS_SCRIPT_EXEC_TIMEOUT: 10000,
 };
 // Allows us to force certain environment variable into a type, instead of relying
 // on the auto-parsed type in processValues. ref #3705

package/dist/mailer.js

@@ -55,10 +55,18 @@ export default function getMailer() {
         }));
     }
     else if (transportName === 'sendgrid') {
-        const sg = require('nodemailer-sendgrid');
-        transporter = nodemailer.createTransport(sg({
-            apiKey: env['EMAIL_SENDGRID_API_KEY'],
-        }));
+        let auth = false;
+        if (env['EMAIL_SENDGRID_API_KEY'] || env['EMAIL_SMTP_PASSWORD']) {
+            auth = {
+                user: 'apikey',
+                pass: env['EMAIL_SENDGRID_API_KEY'],
+            };
+        }
+        transporter = nodemailer.createTransport({
+            host: 'smtp.sendgrid.net',
+            port: 587,
+            auth,
+        });
     }
     else {
         logger.warn('Illegal transport given for email. Check the EMAIL_TRANSPORT env var.');

package/dist/middleware/respond.js

@@ -22,7 +22,8 @@ export const respond = asyncHandler(async (req, res) => {
         cache &&
         !req.sanitizedQuery.export &&
         res.locals['cache'] !== false &&
-        exceedsMaxSize === false) {
+        exceedsMaxSize === false &&
+        req.originalUrl?.startsWith('/auth')) {
         const key = getCacheKey(req);
         try {
             await setCacheValue(cache, key, res.locals['payload'], getMilliseconds(env['CACHE_TTL']));

package/dist/operations/exec/index.d.ts

@@ -1,5 +1,5 @@
-type Options = {
+type ExecutionOptions = {
     code: string;
 };
-declare const _default: import("@wbce-d9/types").OperationApiConfig<Options>;
+declare const _default: import("@wbce-d9/types").OperationApiConfig<ExecutionOptions>;
 export default _default;

package/dist/operations/exec/index.js

@@ -1,38 +1,44 @@
-import { defineOperationApi, toArray } from '@wbce-d9/utils';
-import { isBuiltin } from 'node:module';
-import { NodeVM, VMScript } from 'vm2';
+import { defineOperationApi } from '@wbce-d9/utils';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const ivm = require('isolated-vm');
 export default defineOperationApi({
-    id: 'exec',
-    handler: async ({ code }, { data, env }) => {
-        const allowedModules = env['FLOWS_EXEC_ALLOWED_MODULES'] ? toArray(env['FLOWS_EXEC_ALLOWED_MODULES']) : [];
-        const allowedModulesBuiltIn = [];
-        const allowedModulesExternal = [];
-        const allowedEnv = data['$env'] ?? {};
-        const opts = {
-            eval: false,
-            wasm: false,
-            env: allowedEnv,
-        };
-        for (const module of allowedModules) {
-            if (isBuiltin(module)) {
-                allowedModulesBuiltIn.push(module);
-            }
-            else {
-                allowedModulesExternal.push(module);
-            }
-        }
-        if (allowedModules.length > 0) {
-            opts.require = {
-                builtin: allowedModulesBuiltIn,
-                external: {
-                    modules: allowedModulesExternal,
-                    transitive: false,
-                },
-            };
-        }
-        const vm = new NodeVM(opts);
-        const script = new VMScript(code).compile();
-        const fn = await vm.run(script);
-        return await fn(data);
+    id: 'execute_script',
+    handler: async ({ code }, { data, env, logger }) => {
+        // Fetching execution limits and environment variables
+        const memoryLimit = env['FLOWS_SCRIPT_MAX_MEMORY'];
+        const executionTimeout = env['FLOWS_SCRIPT_EXEC_TIMEOUT'];
+        const environmentVariables = data['$env'] ?? {};
+        // Creating an isolate with the specified memory limit
+        const isolate = new ivm.Isolate({ memoryLimit });
+        const context = isolate.createContextSync();
+        const jail = context.global;
+        jail.setSync('global', jail.derefInto());
+        jail.setSync('process', { env: environmentVariables }, { copy: true });
+        jail.setSync('module', { exports: null }, { copy: true });
+        // Adding a secure logger for the isolate
+        const createLoggerCallback = (logFn) => new ivm.Callback((...args) => logFn(args.length === 1 ? args[0] : args), { sync: true });
+        jail.setSync('console', {
+            log: createLoggerCallback(() => logger.info),
+            info: createLoggerCallback(() => logger.info),
+            warn: createLoggerCallback(() => logger.warn),
+            error: createLoggerCallback(() => logger.error),
+            debug: createLoggerCallback(() => logger.debug),
+            trace: createLoggerCallback(() => logger.trace),
+        }, { copy: true });
+        // Executing the code within the isolate
+        await context.eval(code, { timeout: executionTimeout });
+        const dataCopy = new ivm.ExternalCopy({ data });
+        const resultReference = await context.evalClosure(`return module.exports($0.data)`, [dataCopy.copyInto()], {
+            result: { reference: true, promise: true },
+            timeout: executionTimeout,
+        });
+        const finalResult = await resultReference.copy();
+        // Cleanup memory
+        resultReference.release();
+        dataCopy.release();
+        context.release();
+        isolate.dispose();
+        return finalResult;
     },
 });

package/dist/services/authentication.js

@@ -7,7 +7,7 @@ import { DEFAULT_AUTH_PROVIDER } from '../constants.js';
 import getDatabase from '../database/index.js';
 import emitter from '../emitter.js';
 import env from '../env.js';
-import { InvalidCredentialsException, InvalidOTPException, InvalidProviderException, UserSuspendedException, } from '../exceptions/index.js';
+import { InvalidCredentialsException, InvalidOTPException, UserSuspendedException } from '../exceptions/index.js';
 import { createRateLimiter } from '../rate-limiter.js';
 import { getMilliseconds } from '../utils/get-milliseconds.js';
 import { stall } from '../utils/stall.js';
@@ -72,20 +72,10 @@ export class AuthenticationService {
                 accountability: this.accountability,
             });
         };
-        if (user?.status !== 'active') {
+        if (user?.status !== 'active' || user.provider.toLowerCase() !== providerName.toLowerCase()) {
             emitStatus('fail');
-            if (user?.status === 'suspended') {
-                await stall(STALL_TIME, timeStart);
-                throw new UserSuspendedException();
-            }
-            else {
-                await stall(STALL_TIME, timeStart);
-                throw new InvalidCredentialsException();
-            }
-        }
-        else if (user.provider.toLowerCase() !== providerName.toLowerCase()) {
             await stall(STALL_TIME, timeStart);
-            throw new InvalidProviderException();
+            throw new InvalidCredentialsException();
         }
         const settingsService = new SettingsService({
             knex: this.knex,

package/dist/services/graphql/index.js

@@ -1526,16 +1526,6 @@ export class GraphQLService {
                         }),
                     }
                     : GraphQLBoolean,
-                flows: {
-                    type: new GraphQLObjectType({
-                        name: 'server_info_flows',
-                        fields: {
-                            execAllowedModules: {
-                                type: new GraphQLList(GraphQLString),
-                            },
-                        },
-                    }),
-                },
             });
         }
         if (this.accountability?.admin === true) {
@@ -1894,10 +1884,10 @@ export class GraphQLService {
                 },
                 resolve: async (_, args) => {
                     const { nanoid } = await import('nanoid');
-                    if (args['length'] && Number(args['length']) > 500) {
-                        throw new InvalidPayloadException(`"length" can't be more than 500 characters`);
+                    if (args['length'] !== undefined && (args['length'] < 1 || args['length'] > 500)) {
+                        throw new InvalidPayloadException(`"length" must be between 1 and 500`);
                     }
-                    return nanoid(args['length'] ? Number(args['length']) : 32);
+                    return nanoid(args['length'] ? args['length'] : 32);
                 },
             },
             utils_hash_generate: {

package/dist/services/server.js

@@ -61,9 +61,6 @@ export class ServerService {
             else {
                 info['rateLimitGlobal'] = false;
             }
-            info['flows'] = {
-                execAllowedModules: env['FLOWS_EXEC_ALLOWED_MODULES'] ? toArray(env['FLOWS_EXEC_ALLOWED_MODULES']) : [],
-            };
         }
         if (this.accountability?.admin === true) {
             const { osType, osVersion } = getOSInfo();

package/dist/services/users.js

@@ -117,7 +117,7 @@ export class UsersService extends ItemsService {
      */
     async getUserByEmail(email) {
         return await this.knex
-            .select('id', 'role', 'status', 'password')
+            .select('id', 'role', 'status', 'password', 'email')
             .from('directus_users')
             .whereRaw(`LOWER(??) = ?`, ['email', email.toLowerCase()])
             .first();
@@ -307,13 +307,13 @@ export class UsersService extends ItemsService {
             if (isEmpty(user) || user.status === 'invited') {
                 const subjectLine = subject ?? "You've been invited";
                 await mailService.send({
-                    to: email,
+                    to: user.email,
                     subject: subjectLine,
                     template: {
                         name: 'user-invitation',
                         data: {
                             url: this.inviteUrl(email, url),
-                            email,
+                            email: user.email,
                         },
                     },
                 });
@@ -351,20 +351,20 @@ export class UsersService extends ItemsService {
             knex: this.knex,
             accountability: this.accountability,
         });
-        const payload = { email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
+        const payload = { email: user.email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
         const token = jwt.sign(payload, env['SECRET'], { expiresIn: '1d', issuer: 'directus' });
         const acceptURL = url
             ? new Url(url).setQuery('token', token).toString()
             : new Url(env['PUBLIC_URL']).addPath('admin', 'reset-password').setQuery('token', token).toString();
         const subjectLine = subject ? subject : 'Password Reset Request';
         await mailService.send({
-            to: email,
+            to: user.email,
             subject: subjectLine,
             template: {
                 name: 'password-reset',
                 data: {
                     url: acceptURL,
-                    email,
+                    email: user.email,
                 },
             },
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "10.4.0",
+  "version": "11.0.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -72,7 +72,7 @@
     "@wbce-d9/format-title": "10.0.0",
     "argon2": "0.30.3",
     "async": "3.2.4",
-    "axios": "^1.7.2",
+    "axios": "^1.8.2",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "7.0.1",
@@ -80,7 +80,7 @@
     "chokidar": "3.5.3",
     "commander": "10.0.1",
     "content-disposition": "0.5.4",
-    "cookie-parser": "1.4.6",
+    "cookie-parser": "1.4.7",
     "cors": "2.8.5",
     "csv-parser": "3.0.0",
     "date-fns": "2.29.3",
@@ -91,23 +91,24 @@
     "eventemitter2": "6.4.9",
     "execa": "7.1.1",
     "exif-reader": "1.2.0",
-    "express": "4.18.2",
+    "express": "^4.21.2",
     "fast-redact": "3.1.2",
     "flat": "5.0.2",
     "fs-extra": "11.1.1",
-    "graphql": "16.6.0",
+    "graphql": "16.8.1",
     "graphql-compose": "9.0.10",
     "helmet": "6.1.5",
     "icc": "3.0.0",
     "inquirer": "9.1.5",
     "ioredis": "5.3.2",
+    "isolated-vm": "^5.0.3",
     "joi": "17.9.1",
     "js-yaml": "4.1.0",
     "js2xmlparser": "5.0.0",
     "json2csv": "5.0.7",
     "jsonwebtoken": "9.0.0",
     "keyv": "4.5.2",
-    "knex": "2.4.2",
+    "knex": "3.1.0",
     "ldapjs": "2.3.3",
     "liquidjs": "10.7.0",
     "lodash-es": "4.17.21",
@@ -115,10 +116,10 @@
     "micromustache": "8.0.3",
     "mime-types": "2.1.35",
     "ms": "2.1.3",
-    "nanoid": "4.0.2",
+    "nanoid": "5.0.9",
     "node-cron": "3.0.2",
     "node-machine-id": "1.1.12",
-    "nodemailer": "6.9.1",
+    "nodemailer": "6.9.9",
     "object-hash": "3.0.0",
     "openapi3-ts": "3.2.0",
     "openid-client": "5.4.0",
@@ -130,10 +131,10 @@
     "pino-pretty": "10.0.0",
     "qs": "6.11.1",
     "rate-limiter-flexible": "2.4.1",
-    "rollup": "3.20.7",
+    "rollup": "3.29.5",
     "samlify": "2.8.10",
-    "sanitize-html": "2.10.0",
-    "sharp": "0.32.0",
+    "sanitize-html": "2.12.1",
+    "sharp": "0.32.6",
     "snappy": "7.2.2",
     "stream-json": "1.7.5",
     "strip-bom-stream": "5.0.0",
@@ -141,22 +142,21 @@
     "tsx": "3.12.6",
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
-    "vm2": "^3.9.19",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.30.0",
+    "@wbce-d9/app": "9.33.0",
+    "@wbce-d9/constants": "9.28.0",
+    "@wbce-d9/extensions-sdk": "9.27.1",
     "@wbce-d9/exceptions": "9.26.4",
-    "@wbce-d9/constants": "9.27.0",
-    "@wbce-d9/extensions-sdk": "9.26.7",
-    "@wbce-d9/schema": "9.26.4",
-    "@wbce-d9/storage": "9.26.4",
     "@wbce-d9/specs": "9.26.4",
-    "@wbce-d9/storage-driver-azure": "9.26.7",
-    "@wbce-d9/storage-driver-cloudinary": "9.26.7",
-    "@wbce-d9/storage-driver-gcs": "9.26.7",
-    "@wbce-d9/update-check": "9.26.4",
-    "@wbce-d9/storage-driver-local": "9.26.7",
-    "@wbce-d9/storage-driver-s3": "9.26.9",
-    "@wbce-d9/utils": "9.29.0"
+    "@wbce-d9/storage-driver-azure": "9.26.8",
+    "@wbce-d9/storage": "9.26.4",
+    "@wbce-d9/storage-driver-cloudinary": "9.27.0",
+    "@wbce-d9/schema": "9.26.4",
+    "@wbce-d9/storage-driver-s3": "9.26.10",
+    "@wbce-d9/utils": "9.29.1",
+    "@wbce-d9/storage-driver-local": "9.26.8",
+    "@wbce-d9/storage-driver-gcs": "9.26.8",
+    "@wbce-d9/update-check": "9.28.0"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -200,11 +200,11 @@
     "@wbce-d9/tsconfig": "0.0.7",
     "copyfiles": "2.4.1",
     "form-data": "4.0.0",
-    "knex-mock-client": "2.0.0",
+    "knex-mock-client": "3.0.2",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
     "vitest": "0.30.1",
-    "@wbce-d9/types": "9.27.0"
+    "@wbce-d9/types": "9.28.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",
@@ -212,10 +212,9 @@
     "memcached": "2.2.2",
     "mysql": "2.18.1",
     "nodemailer-mailgun-transport": "2.1.5",
-    "nodemailer-sendgrid": "1.0.3",
     "pg": "8.10.0",
     "sqlite3": "5.1.6",
-    "tedious": "16.0.0"
+    "tedious": "18.6.1"
   },
   "engines": {
     "node": ">=18.0.0"